Certificate Pool

In addition to the Built-In CA →, which issues certificates itself, Relution supports certification authorities of the type Custom Pool. In this case an existing, external PKI serves as the source: the certificates issued there are imported into Relution as an archive and kept as a pool. Whenever a certificate is required for a configuration, it is assigned from this pool instead of being generated.

Create a certification authority of the type Custom Pool #

The authority is created under Settings → Certification Authorities → Add. In the drop-down menu for the type of certification authority, the entry Custom Pool is selected.

Mandatory fields

• Name: Name of the certification authority in Relution.

Details related to certificate issuance — such as a password for the root certificate, a common name or an expiration date — are not required, because a certificate pool does not sign certificates itself.

Import certificates into the pool #

The import is performed by editing the previously created certification authority. There, a ZIP archive containing the externally issued certificate files is uploaded.

The subtype is also defined for the import. It determines the function for which the certificates are available later on; WIFI is preselected. The available options are the same functions that apply to user certificates: GENERAL_CERTIFICATE, WIFI, EXCHANGE, VPN, SMIME_ENCRYPTION and SMIME_SIGNING (see User certificates →).

Structure of the archive #

The ZIP archive contains the PKCS#12 containers of the externally issued certificates as well as a CSV file that assigns each certificate to a user account. The separator is a semicolon, the header row is:

#E-Mail-Adresse;#P12-Passwort;#Zertifikatstyp

One row per certificate, for example:

#E-Mail-Adresse;#P12-Passwort;#Zertifikatstyp
max.mustermann@example.com;secretPassword;WIFI

The CSV row and the certificate are matched by file name: the certificate file in the archive is named after the email address in the first column, in this example max.mustermann@example.com.p12. If the file name differs from the email address, the certificate cannot be assigned.

Imported certificates in the certificate management #

The imported certificates then appear under Settings → Certificates, each with the subtype selected during the import — WIFI in the case described here. This view allows the certificates to be inspected and managed like all other stored certificates, see Certificate Management →.

Certificate template for a certificate pool #

So that the certificates from the pool can be used in policy configurations, a template is created under Settings → Certificate templates → Add.

For a certificate pool, only the following fields are displayed:

• Name: Name of the template.
• Certification authority: The previously created Custom Pool certification authority.
• Enable auto-renew (in days): A certificate is automatically renewed if its expiration date falls within this period.

Validation #

The setup is complete once

• the certification authority of the type Custom Pool has been created,
• the import of the ZIP archive with the subtype WIFI has completed without duplicates and without errors,
• the imported certificates are listed under Settings → Certificates with the subtype WIFI, and
• the certificate template for the Custom Pool certification authority is displayed without any fields for certificate generation, but with the renewal options.

Using the template in a policy follows the same procedure as with the Built-In CA, see Built-In CA →.